PT-2026-1131 · Bagisto · Bagisto

Cybercrew-Analyst · Published 2026-01-02 · Updated 2026-01-03 · CVE-2026-21451

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.10

Description Bagisto, an open source laravel eCommerce platform, contains a stored Cross-Site Scripting (XSS) issue within the CMS page editor. The platform’s attempt to sanitize <script> tags can be bypassed by manipulating the raw HTTP POST request before submission. This allows arbitrary JavaScript to be stored in the CMS content and executed when the page is viewed or edited. This poses a high-severity risk to administrators, potentially leading to complete account takeover, backend hijacking, and malicious script execution. The vulnerability exists due to insufficient input validation when handling CMS page content.

Recommendations Update to version 2.3.10 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-21451

GHSA-2MWC-H2MG-V6P8

Affected Products

Bagisto

References · 11

• 🔥 https://github.com/bagisto/bagisto/security/advisories/GHSA-2mwc-h2mg-v6p8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21451.json · Exploit
• https://osv.dev/vulnerability/GHSA-2mwc-h2mg-v6p8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21451 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21451 · Vendor Advisory
• https://github.com/bagisto/bagisto · Note
• https://github.com/bagisto/bagisto/commit/f533b1cd9c80896792da60976179c95573d78b79 · Note
• https://github.com/bagisto/bagisto/releases/tag/v2.3.10 · Note
• https://twitter.com/CVEnew/status/2007193948050337797 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2007300987237675011 · Twitter Post
• https://t.me/CVEtracker/41299 · Telegram Post